The Cyprus Securities and Exchange Commission (CySEC) published a practical guide yesterday (Tuesday) explaining how employees at the firms it supervises can report suspected breaches of EU financial law straight to the regulator. The document sets out who is allowed to come forward, what counts as a reportable violation, and how CySEC handles each tip, while conceding that the watchdog cannot compensate anyone who is punished for speaking up.

The guide builds on a whistleblower regime Cyprus tightened earlier in 2026. In March, the island moved its market-abuse reporting rules off regulatory circulars and into national law, making it a criminal offense to suppress a report, punishable by up to three years in prison or a €30,000 (about $33,000) fine. Tuesday's document is the operating manual for that statute.

A Reporting Channel Pointed at the Broker Industry

Almost anyone attached to a supervised firm can file a report. The guide names current, former and prospective employees, along with board members, shareholders, unpaid trainees and volunteers, and says reports can be submitted by phone, email, post or in a face-to-face meeting, either anonymously or by name.

What they can report reads like a checklist of the conduct CySEC already polices at Cyprus Investment Firms. The 22 categories include insider dealing, naked short selling, undisclosed conflicts of interest and the sale of high-risk products to retail clients without the suitability checks required under MiFID II. Britain's regulator has chased the same problems, warning contracts-for-difference providers last year over fair-value and disclosure failures.

• CySEC Suspends Mind Money's Licence Weeks After Russian Arrests of Its Executives
• CySEC Chairman Backs EU Supervision Push, Wants a "Level Playing Field"
• Spain Treats Spot-Quoted and Perpetual Futures as CFDs in Notice to Cyprus Brokers

Once a report lands, CySEC says it will confirm receipt within seven days and follow up within three months, or six in complex cases.

Where CySEC's Protection Stops

The guide is blunt about the limits of what a whistleblower gets in return. It catalogs 17 forms of retaliation, among them dismissal, demotion, industry-wide blacklisting, reputational attacks on social media and even coerced psychiatric referrals.

Protection also reaches the people around a reporter, including relatives, colleagues and anyone who helps file the report, and the document notes that handing information to CySEC does not breach any confidentiality clause or contract.

Then comes the caveat. Acting as an external reporting channel, CySEC says it "has no power or authority to remedy any damage" a person suffers from retaliation. A whistleblower who loses a job or a contract is directed instead to the Ministry of Justice and the courts.

Reports are handled confidentially, and personal data tied to a case is deleted within three months of the file closing, unless legal proceedings are still running.

How Cyprus Stacks Up Against Washington and London

Cyprus offers no money for a tip, a sharp contrast with the United States. The Securities and Exchange Commission pays whistleblowers between 10% and 30% of the penalties their information helps collect, and has handed out more than $1.3 billion since the program started in 2012, with individual awards running into the tens of millions.

Britain's Financial Conduct Authority does not pay bounties either, but it publishes a running tally of what comes in. The FCA logged 1,131 whistleblowing reports carrying 2,684 allegations in the year to March 2025, with compliance and consumer-protection failures at the top of the list. CySEC publishes no equivalent count of reports received or acted on.

Nicosia Turns Up the Pressure on Brokers

The channel arrives as CySEC leans harder on the island's brokers. Chair George Theocharides has signaled tougher supervision through 2026, and the regulator has run on-site visits into how firms handle conflicts of interest, pay structures and platform design. It has also fined brokers including BDSwiss and IC Markets for routing clients to offshore units.

That supervision covers a large industry. Cyprus licenses more than 250 investment firms serving around 3.6 million clients, according to Finance Magnates' earlier reporting, which makes the pool of potential reporters, current and former staff at those firms, a wide one.

For any of them weighing whether to come forward, the guide is clear on one point. CySEC will take the report, but any claim for damages has to go to the Ministry of Justice and the courts.